What should be on a data room security checklist before you upload anything

Confirm two factor authentication is available and can be made mandatory for every external viewer, not optional. Confirm permissions can be set per document and per viewer, view only, print allowed, download allowed, rather than only at the folder level, since folder level control alone forces an administrator to either over expose or under expose material.

Ask specifically how access is revoked: whether revocation is instant and applies even to documents already downloaded through the platform's own viewer, since some watermarked PDF downloads remain readable offline after revocation while others expire.

Confirm dynamic watermarking stamps the viewer's name, email and a timestamp on every page at the point of viewing, not just on download, since this is what deters and traces leaks. Confirm whether the platform offers screen capture protection or at least detection, recognising that no software can fully prevent someone photographing a screen, but that some platforms make casual copying meaningfully harder than others.

Check print and download controls can be set independently, since a viewer who should be able to read but not retain a document needs view only with printing disabled, not just a download block that still permits printing to PDF.

Ask the vendor directly for their current ISO 27001 certificate and SOC 2 report rather than relying on a badge shown on the marketing site, since certifications lapse and scope varies. Confirm where customer data is physically hosted and whether that satisfies UK GDPR or EU GDPR requirements for the parties involved, particularly where the deal involves personal data on employees or customers.

Confirm the audit log records every view, download and print action with a timestamp and viewer identity, and that this log can be exported, since it is the evidence a seller relies on if a leak is ever disputed after the deal closes.

Ask what backup and disaster recovery policy applies to the room's contents, and what the vendor's stated uptime commitment is, since a room that goes offline during a live negotiation has real commercial consequences. Confirm what happens to data after the deal closes, whether documents are retained, for how long, and under what process they are permanently deleted, since indefinite retention of a failed deal's sensitive documents is itself a liability.

Finally, build an internal offboarding step into the deal process itself: the day a deal completes or falls through, revoke every external viewer's access from the platform administration panel rather than trusting that access will simply lapse or that a departed advisor will remember to ask for removal.

For how individual platforms score against these criteria, see the full ranking at /rankings and the method at /methodology. Current pricing across the vendors compared here is at /pricing.